Writing
Latest from RockCyber Musings
RockCyber Musings is where I think out loud about AI security, governance, and the risk calls executives have to make. The last twenty posts are below, each one links to the full piece on Substack.
Weekly Musings Top 10 AI Security Wrapup: Issue 62: November 6 to November 12, 2026
AI agents found the bugs on about twenty approvals this week. The checking layer, from model weights to enclave builds to the triage queue, is now the constraint, and Canberra has promised to write it
Agentic AI Breach Containment: Who Signs Off on Killing Production?
GitBook went dark 15 hours to stop an attacker. RockCyber Musings shows why agentic AI breach containment hinges on the smallest identity you can revoke.
Weekly Musings Top 10 AI Security Wrapup: Issue 61: October 30 to November 5, 2026
OpenAI's agents built Linux root exploits for about $1,280 apiece while AI platforms kept losing keys the old way. 11 verified AI security stories from October 30 to November 5, 2026, and what to them
Anthropic’s S-1 Prices Open-Weight Models. Its Red Team Tested One.
Anthropic S-1 open-weight models get filed as cheap. Its red team found GLM-5.3 near Mythos on exploits. Get the forecast and 4 things a CISO should do immediately
Weekly Musings Top 10 AI Security Wrapup: Issue 60: October 23 to October 29, 2026
Fred Wilmot and I released the Context Bill of Materials at [un]prompted II, because the operator wrote 0.10% of what the model read. Eleven verified AI security stories from October 23 to 29, 2026.
Context Bill of Materials: A Record of What Your AI Agent Read
See what your AI agent read. The Context Bill of Materials signs MCP tool definitions and records each inference it builds. Open source.
Weekly Musings Top 10 AI Security Wrapup: Issue 59: October 16 to October 22, 2026
A CA key equal to 4, a PHP embargo that leaked before the patch, and a LiteLLM release poisoned behind the latest tag. Eleven verified AI security stories for CISOs, with the moves to make this week.
AI Evaluation Security Needs a Bypass Certificate
AI evaluation security failed at four frontier labs. Get process safety's bypass rules, proof test math, and a six-field certificate.
Weekly Musings Top 10 AI Security Wrapup: Issue 58: October 9 to October 15, 2026
The FTC and Brussels asked the labs for their records, Bank of America paid for Mythos in contractors, and Anthropic pulled its own internet. 11 verified AI security stories from October 9 to 15, 2026
AI Made Security the Bottleneck. Then the CFO Came for the Reviewers.
AI moved the bottleneck to the people who check its work, and the queue math shows what happens to everyone else when you cut one of them.
Weekly Musings Top 10 AI Security Wrapup: Issue 57: October 2 to October 8, 2026
Agent Session Logs, The Identity Gap, And The Week A Vendor Said Injection Is Not A Bug
Evaluating AI Security Research: Eight Questions Before You Fund It
Use eight questions for evaluating AI security research. Find the attack success rate denominator, condition, and baseline in 15 minutes.
Weekly Musings Top 10 AI Security Wrapup: Issue 54: September 25 to October 1, 2026
Your AI incident postmortem is now discoverable evidence. 11 verified AI security governance stories, with the specific moves CISOs should make this week.
Human in the Loop Is a Rubber Stamp. Its Replacements Are Too.
See why human in the loop approval let 40.4% of AI agent overreach through, why model approvers leak too, and the budget control that holds.
Weekly Musings Top 10 AI Security Wrapup: Issue 53: September 18 to September 24, 2026
An OpenAI Agent Hacked Medicare, Three Lab CEOs Briefed The Security Council, And California Wrote A Kill Switch Into An Executive Order
The Math Behind the AI Agent Restart Gate: OpenAI Hit Restart on July 7. The Hugging Face Breach Began July 8.
Read September's OpenAI and Anthropic reports like a data scientist, then find the AI agent restart gate July 7 lacked. Four checks from process safety.
Weekly Musings Top 10 AI Security Wrapup: Issue 52: September 11 to September 17, 2026
OpenAI disclosed six misalignment incidents, got accused of breaking SB 53, then backed federal AI audits. Plus NIST names AI agents in token guidance.
All AI Extinction Risk Panic Does Is Ban the Safer Model and Keep the Worse One.
AI extinction risk panic bans the safer model, keeps the worse one, and jails the builders. I did the math the Senate won't. It rounds to couch change.
OpenAI Audited Its Bio Safeguards. It Skipped the Cyber Ones
OpenAI's AI safeguard evaluation covered bio and skipped cyber, the one domain GPT-6 Astra rated Critical. Here is what to ask your model vendor at renewal.
Weekly Musings Top 10 AI Security Wrapup: Issue 51: August 28 to September 3, 2026
When the Agents Went Operational: AI-Run Ransomware, a Frontier Cyber-Model Arms Race, and a Control Gap Your Board Can Measure
Subscribe to the newsletter
Get RockCyber Musings in your inbox. It is free, and you can leave whenever you want.